Skip to content

fix(datasource): align access validation in legacy views#38647

Draft
sha174n wants to merge 2 commits intoapache:masterfrom
sha174n:fix/datasource-idor-access-checks
Draft

fix(datasource): align access validation in legacy views#38647
sha174n wants to merge 2 commits intoapache:masterfrom
sha174n:fix/datasource-idor-access-checks

Conversation

@sha174n
Copy link
Contributor

@sha174n sha174n commented Mar 14, 2026

SUMMARY

This PR updates the legacy datasource views to ensure consistent resource-level validation across metadata and save endpoints.

Changes:

  • Validation Alignment: Integrated security_manager.raise_for_access into the get, external_metadata, and external_metadata_by_name methods to align with standard application patterns.
  • Ownership Verification: Refactored the save method to ensure resource ownership is validated for all update requests, regardless of the specific structure of the request payload.
  • Protocol Consistency: These updates ensure that the older /datasource endpoints follow the same validation protocols used in the modern REST API layers.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

(Note: Please re-attach the screenshots/GIFs that were previously in this section.)

TESTING INSTRUCTIONS

Automated Tests:
Verify the authorization logic by running the unit test suite:

pytest tests/unit_tests/views/datasource/views_test.py

Manual Verification:

  1. Check Metadata Access: Attempt to call the legacy get or external_metadata endpoints using a datasource ID that the current user is not authorized to view.
  2. Verify Response: Confirm the application correctly denies the request (returns a 403 or redirects) rather than returning the metadata.
  3. Check Update Logic: Call the /datasource/save/ endpoint with an update to a datasource the user does not own, and verify the request is blocked even if the owners field is omitted from the request data.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration
  • Introduces new feature or API
  • Removes existing feature or API

@codecov
Copy link

codecov bot commented Mar 14, 2026

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 64.24%. Comparing base (ed622e2) to head (54c90ee).
⚠️ Report is 5 commits behind head on master.

Files with missing lines Patch % Lines
superset/views/datasource/views.py 80.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #38647      +/-   ##
==========================================
- Coverage   64.99%   64.24%   -0.75%     
==========================================
  Files        1819     2532     +713     
  Lines       72515   129547   +57032     
  Branches    23149    29905    +6756     
==========================================
+ Hits        47128    83231   +36103     
- Misses      25387    44864   +19477     
- Partials        0     1452    +1452     
Flag Coverage Δ
hive 40.59% <0.00%> (?)
mysql 61.59% <80.00%> (?)
postgres 61.66% <80.00%> (?)
presto 40.61% <0.00%> (?)
python 63.27% <80.00%> (?)
sqlite 61.29% <80.00%> (?)
unit 100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@sha174n sha174n changed the title Fix/datasource idor access checks fix(datasource): enforce consistent access control in legacy views Mar 14, 2026
@sha174n sha174n changed the title fix(datasource): enforce consistent access control in legacy views fix(datasource): align access validation in legacy views Mar 14, 2026
…ource view

Add `security_manager.raise_for_access(datasource=datasource)` to the
`get` and `external_metadata` view methods immediately after the datasource
is retrieved from the DAO.

For `external_metadata_by_name`, call `raise_for_access(datasource=...)` when
a known datasource is found, and `raise_for_access(database=..., table=...)` when
resolving an unregistered table via the SQLAlchemy inspector.

In `save`, remove the `if "owners" in datasource_dict` guard so that
`raise_for_ownership` is always evaluated, regardless of whether the caller
omits the `owners` field from the payload.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sha174n sha174n force-pushed the fix/datasource-idor-access-checks branch from 7eaf8f0 to 1d67c49 Compare March 14, 2026 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant